Project

General

Profile

Download (14.7 KB) Statistics
| Branch: | Tag: | Revision:
1 5b237745 Scott Ullrich
#!/usr/local/bin/php
2 e2411886 Scott Ullrich
<?php 
3 5b237745 Scott Ullrich
/*
4
	vpn_openvpn.php
5
6
	Copyright (C) 2004 Peter Curran (peter@closeconsultants.com).
7
	All rights reserved.
8 e2411886 Scott Ullrich
	
9 5b237745 Scott Ullrich
	Redistribution and use in source and binary forms, with or without
10
	modification, are permitted provided that the following conditions are met:
11 e2411886 Scott Ullrich
	
12 5b237745 Scott Ullrich
	1. Redistributions of source code must retain the above copyright notice,
13
	   this list of conditions and the following disclaimer.
14 e2411886 Scott Ullrich
	
15 5b237745 Scott Ullrich
	2. Redistributions in binary form must reproduce the above copyright
16
	   notice, this list of conditions and the following disclaimer in the
17
	   documentation and/or other materials provided with the distribution.
18 e2411886 Scott Ullrich
	
19 5b237745 Scott Ullrich
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28
	POSSIBILITY OF SUCH DAMAGE.
29
*/
30
31
require("guiconfig.inc");
32
require_once("openvpn.inc");
33
34
if (!is_array($config['ovpn']))
35
	$config['ovpn'] = array();
36
if (!is_array($config['ovpn']['server'])){
37
	$config['ovpn']['server'] =  array();
38
	$config['ovpn']['server']['tun_iface'] = "tun0";
39
	$config['ovpn']['server']['psh_options'] = array();
40
	/* Initialise with some sensible defaults */
41
	$config['ovpn']['server']['port'] = 5000;
42
	$config['ovpn']['server']['proto'] = 'UDP';
43
	$config['ovpn']['server']['maxcli'] = 25;
44
	$config['ovpn']['server']['crypto'] = 'BF-CBC';
45
	$config['ovpn']['server']['dupcn'] = true;
46
	$config['ovpn']['server']['verb'] = 1;
47
}
48
49
if ($_POST) {
50
51
	unset($input_errors);
52
53
	/* input validation */
54
	if ($_POST['enable']) {
55
		$reqdfields = explode(" ", "tun_iface bind_iface ipblock");
56
		$reqdfieldsn = explode(",", "Tunnel type,Interface binding,IP address block start");
57
58
		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
59
60
	}
61 e2411886 Scott Ullrich
	
62 5b237745 Scott Ullrich
	/* need a test here to make sure prefix and max_clients are coherent */
63 e2411886 Scott Ullrich
	
64 5b237745 Scott Ullrich
	/* Sort out the cert+key files */
65
	if (is_null($_POST['ca_cert']))
66
		$input_errors[] = "You must provide a CA certificate file";
67
	elseif (!strstr($_POST['ca_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['ca_cert'], "END CERTIFICATE"))
68
		$input_errors[] = "The CA certificate does not appear to be valid.";
69 e2411886 Scott Ullrich
		
70 5b237745 Scott Ullrich
	if (is_null($_POST['srv_cert']))
71
		$input_errors[] = "You must provide a server certificate file";
72
	elseif (!strstr($_POST['srv_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['srv_cert'], "END CERTIFICATE"))
73
		$input_errors[] = "The server certificate does not appear to be valid.";
74 e2411886 Scott Ullrich
		
75 5b237745 Scott Ullrich
	if (is_null($_POST['srv_key']))
76
		$input_errors[] = "You must provide a server key file";
77
	elseif (!strstr($_POST['srv_key'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['srv_key'], "END RSA PRIVATE KEY"))
78
		$input_errors[] = "The server key does not appear to be valid.";
79 e2411886 Scott Ullrich
		
80 5b237745 Scott Ullrich
	if (is_null($_POST['dh_param']))
81
		$input_errors[] = "You must provide a DH parameters file";
82
	elseif (!strstr($_POST['dh_param'], "BEGIN DH PARAMETERS") || !strstr($_POST['dh_param'], "END DH PARAMETERS"))
83
		$input_errors[] = "The DH parameters do not appear to be valid.";
84 e2411886 Scott Ullrich
				
85 5b237745 Scott Ullrich
	if (!$input_errors) {
86
		$server =& $config['ovpn']['server'];
87
		$server['enable'] = $_POST['enable'] ? true : false;
88 e2411886 Scott Ullrich
		
89 5b237745 Scott Ullrich
		/* Make sure that the tunnel interface type has not changed */
90 e2411886 Scott Ullrich
		if ($server['tun_iface'] != $_POST['tun_iface']){ 
91 5b237745 Scott Ullrich
			$server['tun_iface'] = $_POST['tun_iface'];
92 3851094f Scott Ullrich
93 5b237745 Scott Ullrich
		}
94 e2411886 Scott Ullrich
		
95 5b237745 Scott Ullrich
		$server['bind_iface'] = $_POST['bind_iface'];
96
		$server['port'] = $_POST['port'];
97
		$server['proto'] = $_POST['proto'];
98 e2411886 Scott Ullrich
		
99 5b237745 Scott Ullrich
		/* Make sure the IP address and/or prefix have not changed */
100
		if ($server['ipblock'] != $_POST['ipblock']){
101
			$server['ipblock'] = $_POST['ipblock'];
102
		}
103
		if ($server['prefix'] != $_POST['prefix']){
104
			$server['prefix'] = $_POST['prefix'];
105
		}
106 e2411886 Scott Ullrich
		
107 5b237745 Scott Ullrich
		$server['maxcli'] = $_POST['maxcli'];
108
		$server['crypto'] = $_POST['crypto'];
109
		$server['cli2cli'] = $_POST['cli2cli'] ? true : false;
110
		$server['dupcn'] = $_POST['dupcn'] ? true : false;
111
		$server['psh_options']['redir'] = $_POST['psh_redir'] ? true : false;
112
		$server['psh_options']['redir_loc'] = $_POST['psh_redir_loc'] ? true : false;
113
		if ($_POST['psh_rtedelay'])
114
			$server['psh_options']['rtedelay'] = $_POST['psh_rtedelay_int'];
115
		if ($_POST['psh_ping'])
116
			$server['psh_options']['ping'] = $_POST['psh_ping_int'];
117
		if ($_POST['psh_pingexit'])
118
			$server['psh_options']['pingexit'] = $_POST['psh_pingexit_int'];
119
		if ($_POST['psh_pingrst'])
120
			$server['psh_options']['pingrst'] = $_POST['psh_pingrst_int'];
121
		if ($_POST['inact'])
122
			$server['psh_options']['inact'] = $_POST['psh_inact_int'];
123
		$server['ca_cert'] = base64_encode($_POST['ca_cert']);
124
		$server['srv_cert'] = base64_encode($_POST['srv_cert']);
125
		$server['srv_key'] = base64_encode($_POST['srv_key']);
126 e2411886 Scott Ullrich
		$server['dh_param'] = base64_encode($_POST['dh_param']);	
127
			
128 5b237745 Scott Ullrich
		write_config();
129
130
		$retval = 0;
131
		if (file_exists($d_sysrebootreqd_path)) {
132
			/* Rewrite interface definitions */
133
			$retval = ovpn_server_iface();
134
		}
135
		else{
136
			ovpn_lock();
137
			$retval = ovpn_config_server();
138
			ovpn_unlock();
139
		}
140
		$savemsg = get_std_save_message($retval);
141
	}
142
}
143
144
/* Simply take a copy of the array */
145
$pconfig = $config['ovpn']['server'];
146
147 b128368a Bill Marquette
$pgtitle = "VPN: OpenVPN";
148 4df96eff Scott Ullrich
include("head.inc");
149
150 5b237745 Scott Ullrich
?>
151 422f27c0 Scott Ullrich
152
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
153 5b237745 Scott Ullrich
<?php include("fbegin.inc"); ?>
154 b128368a Bill Marquette
<p class="pgtitle"><?=$pgtitle?></p>
155 5b237745 Scott Ullrich
<?php if ($input_errors) print_input_errors($input_errors); ?>
156
157
<form action="vpn_openvpn.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
158
<table width="100%" border="0" cellpadding="0" cellspacing="0">
159
  <tr><td>
160 e2411886 Scott Ullrich
  <ul id="tabnav">	        
161 5b237745 Scott Ullrich
	<li class="tabact">Server</li>
162
	<li class="tabinact"><a href="vpn_openvpn_cli.php">Client</a></li>
163
  </ul>
164
  </td></tr>
165
  <tr>
166
  <td class="tabcont">
167
    <strong><span class="red">WARNING: This feature is experimental and modifies your optional interface configuration.
168
  Backup your configuration before using OpenVPN, and restore it before upgrading.<br>
169
&nbsp;  <br>
170
    </span></strong><table width="100%" border="0" cellpadding="6" cellspacing="0">
171
  <tr>
172
    <td width="22%" valign="top" class="vtable">&nbsp;</td>
173
    <td width="78%" class="vtable">
174
      <input name="enable" type="checkbox" value="yes" <?php if (isset($pconfig['enable'])) echo "checked"; ?>>
175
      <strong>Enable OpenVPN server </strong></td>
176
   </tr>
177 e2411886 Scott Ullrich
   
178 5b237745 Scott Ullrich
   <tr>
179
     <td width="22%" valign="top" class="vncellreq">Tunnel type</td>
180
     <td width="78%" class="vtable">
181
       <input type="radio" name="tun_iface" class="formfld" value="tun0" <?php if ($pconfig['tun_iface'] == 'tun0') echo "checked"; ?>>
182
          TUN&nbsp;
183
       <input type="radio" name="tun_iface" class="formfld" value="tap0" <?php if ($pconfig['tun_iface'] == 'tap0') echo "checked"; ?>>
184
          TAP
185
      </td>
186
    </tr>
187 e2411886 Scott Ullrich
    
188 5b237745 Scott Ullrich
    <tr>
189
      <td width="22%" valign="top" class="vncell">OpenVPN protocol/port</td>
190
      <td width="78%" class="vtable">
191
	<input type="radio" name="proto" class="formfld" value="UDP" <?php if ($pconfig['proto'] == 'UDP') echo "checked"; ?>>
192
           UDP&nbsp;
193
        <input type="radio" name="proto" class="formfld" value="TCP" <?php if ($pconfig['proto'] == 'TCP') echo "checked"; ?>>
194
           TCP<br><br>
195 e2411886 Scott Ullrich
        Port: 
196 5b237745 Scott Ullrich
        <input name="port" type="text" class="formfld" size="5" maxlength="5" value="<?= $pconfig['port']; ?>"><br>
197
        Enter the port number to use for the server (default is 5000).</td>
198
    </tr>
199 e2411886 Scott Ullrich
    
200 5b237745 Scott Ullrich
    <tr>
201
      <td width="22%" valign="top" class="vncellreq">Interface binding</td>
202
      <td width="78%" class="vtable">
203
	<select name="bind_iface" class="formfld">
204 e2411886 Scott Ullrich
        <?php 
205 5b237745 Scott Ullrich
	$interfaces = ovpn_real_interface_list();
206
	foreach ($interfaces as $key => $iface):
207
        ?>
208
	<option value="<?=$key;?>" <?php if ($key == $pconfig['bind_iface']) echo "selected"; ?>> <?= $iface;?>
209
        </option>
210
        <?php endforeach;?>
211
        </select>
212
        <span class="vexpl"><br>
213
        Choose an interface for the OpenVPN server to listen on.</span></td>
214
    </tr>
215 e2411886 Scott Ullrich
		
216
    <tr> 
217 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">IP address block</td>
218 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
219 5b237745 Scott Ullrich
        <input name="ipblock" type="text" class="formfld" size="20" value="<?=htmlspecialchars($pconfig['ipblock']);?>">
220 e2411886 Scott Ullrich
        / 
221 5b237745 Scott Ullrich
        <select name="prefix" class="formfld">
222
          <?php for ($i = 29; $i > 19; $i--): ?>
223
          <option value="<?=$i;?>" <?php if ($i == $pconfig['prefix']) echo "selected"; ?>>
224
            <?=$i;?>
225
          </option>
226
          <?php endfor; ?>
227
        </select>
228
        <br>
229
        Enter the IP address block for the OpenVPN server and clients to use.<br>
230
        <br>
231 e2411886 Scott Ullrich
	Maximum number of simultaneous clients: 
232 5b237745 Scott Ullrich
	<input name="maxcli" type="text" class="formfld" size="3" maxlength="3" value="<?=htmlspecialchars($pconfig['maxcli']);?>">
233
	</td>
234
    </tr>
235 e2411886 Scott Ullrich
    
236
    <tr> 
237 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">CA certificate</td>
238 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
239 5b237745 Scott Ullrich
      <textarea name="ca_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['ca_cert']));?></textarea>
240
      <br>
241 e2411886 Scott Ullrich
      Paste a CA certificate in X.509 PEM format here.</td>
242 5b237745 Scott Ullrich
    </tr>
243 e2411886 Scott Ullrich
		
244
    <tr> 
245 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">Server certificate</td>
246
      <td width="78%" class="vtable">
247
        <textarea name="srv_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_cert']));?></textarea>
248
        <br>
249
        Paste a server certificate in X.509 PEM format here.</td>
250
     </tr>
251 e2411886 Scott Ullrich
     
252
     <tr> 
253 5b237745 Scott Ullrich
       <td width="22%" valign="top" class="vncellreq">Server key</td>
254 e2411886 Scott Ullrich
       <td width="78%" class="vtable"> 
255 5b237745 Scott Ullrich
         <textarea name="srv_key" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_key']));?></textarea>
256
         <br>Paste the server RSA private key here.</td>
257
      </tr>
258 e2411886 Scott Ullrich
      
259
      <tr> 
260 5b237745 Scott Ullrich
        <td width="22%" valign="top" class="vncellreq">DH parameters</td>
261 e2411886 Scott Ullrich
        <td width="78%" class="vtable"> 
262 5b237745 Scott Ullrich
	  <textarea name="dh_param" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['dh_param']));?></textarea>
263 e2411886 Scott Ullrich
          <br>          
264 5b237745 Scott Ullrich
          Paste the Diffie-Hellman parameters in PEM format here.</td>
265
      </tr>
266 e2411886 Scott Ullrich
      
267 5b237745 Scott Ullrich
      <tr>
268
        <td width="22%" valign="top" class="vncell">Crypto</td>
269
        <td width="78%" class="vtable">
270
          <select name="crypto" class="formfld">
271
	    <?php $cipher_list = ovpn_get_cipher_list();
272
	    foreach($cipher_list as $key => $value){
273
	    ?>
274
	      <option value="<?= $key ?>" <?php if ($pconfig['crypto'] == $key) echo "selected"; ?>>
275
	        <?= $value ?>
276
	      </option>
277
	    <?php
278
	    }
279
	    ?>
280
	  </select>
281
	  <br>
282
	  Select a data channel encryption cipher.</td>
283
      </tr>
284 e2411886 Scott Ullrich
      
285 5b237745 Scott Ullrich
      <tr>
286
        <td width="22%" valign="top" class="vncell">Internal routing mode</td>
287
        <td width="78%" class="vtable">
288
	  <input name="cli2cli" type="checkbox" value="yes" <?php if (isset($pconfig['cli2cli'])) echo "checked"; ?>>
289
          <strong>Enable client-to-client routing</strong><br>
290
          If this option is on,  clients are allowed to talk to each other.</td>
291
      </tr>
292 e2411886 Scott Ullrich
      
293 5b237745 Scott Ullrich
      <tr>
294
        <td width="22%" valign="top" class="vncell">Client authentication</td>
295
        <td width="78%" class="vtable">
296
	  <input name="dupcn" type="checkbox" value="yes" <?php if (isset($pconfig['dupcn'])) echo "checked"; ?>>
297
          <strong>Permit duplicate client certificates</strong><br>
298
	  If this option is on, clients with duplicate certificates will not be disconnected.</td>
299
      </tr>
300 e2411886 Scott Ullrich
	 
301 5b237745 Scott Ullrich
      <tr>
302
        <td width="22%" valign="top" class="vncell">Client-push options</td>
303
        <td width="78%" class="vtable">
304
	      <table border="0" cellspacing="0" cellpadding="0">
305
	        <tr>
306
              <td><input type="checkbox" name="psh_redir" value="yes" <?php if (isset($pconfig['psh_options']['redir'])) echo "checked"; ?>>
307
              Redirect-gateway</td>
308
              <td>&nbsp;</td>
309
              <td><input type="checkbox" name="psh_redir_loc" value="yes" <?php if (isset($pconfig['psh_options']['redir_loc'])) echo "checked"; ?>>
310
                Local</td>
311
	          </tr>
312
            <tr>
313
              <td><input type="checkbox" name="psh_rtedelay" value="yes" <?php if (isset($pconfig['psh_options']['rtedelay'])) echo "checked"; ?>> Route-delay</td>
314
              <td width="16">&nbsp;</td>
315
              <td><input type="text" name="psh_rtedelay_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['rtedelay']?>"> seconds</td>
316
            </tr>
317
            <tr>
318
              <td><input type="checkbox" name="psh_inact" value="yes" <?php if (isset($pconfig['psh_options']['inact'])) echo "checked"; ?>>
319
    Inactive</td>
320
              <td>&nbsp;</td>
321
              <td><input type="text" name="psh_inact_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['inact']?>">
322
    seconds</td>
323
            </tr>
324
            <tr>
325
              <td><input type="checkbox" name="psh_ping" value="yes" <?php if (isset($pconfig['psh_options']['ping'])) echo "checked"; ?>> Ping</td>
326
              <td>&nbsp;</td>
327
              <td>Interval: <input type="text" name="psh_ping_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['ping']?>"> seconds</td>
328
            </tr>
329
            <tr>
330
              <td><input type="checkbox" name="psh_pingexit" value="yes" <?php if (isset($pconfig['psh_options']['pingexit'])) echo "checked"; ?>> Ping-exit</td>
331
              <td>&nbsp;</td>
332
              <td>Interval: <input type="text" name="psh_pingexit_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingexit']?>"> seconds</td>
333
            </tr>
334
            <tr>
335
              <td><input type="checkbox" name="psh_pingrst" value="yes" <?php if (isset($pconfig['psh_options']['pingrst'])) echo "checked"; ?>> Ping-restart</td>
336
              <td>&nbsp;</td>
337
              <td>Interval: <input type="text" name="psh_pingrst_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingrst']?>"> seconds</td>
338
            </tr>
339
          </table></td>
340
      </tr>
341
      <tr>
342
        <td width="22%" valign="top">&nbsp;</td>
343
        <td width="78%">
344
          <input name="Submit" type="submit" class="formbtn" value="Save">
345
        </td>
346
      </tr>
347
      <tr>
348
        <td width="22%" valign="top">&nbsp;</td>
349
        <td width="78%"><span class="vexpl"><span class="red"><strong>Note:<br>
350
          </strong></span>Changing any settings on this page will disconnect all clients!</span>
351
	</td>
352
      </tr>
353
    </table>  </td>
354
</tr>
355
</table>
356
</form>
357
<?php include("fend.inc"); ?>